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Abstract 

This paper proves one of the open problem posed by Beigi et al. in [BSWllj . Wc consider 
quantum interactive proof systems where in the beginning the verifier and prover send 
messages to each other with the combined length of all messages being at most logarithmic 
(in the input length); and at the end the prover sends a polynomial- length message to the 
verifier. We show that this class has the same expressive power as QMA. 

1 Introduction 

Quantum interactive proof systems (QIP) were introduced by |Wat991 IWat03j as a natural 
extension of interactive proofs (IP) to the quantum computational setting. They have been 
extensively studied and now it's known that the power of quantum interactive proof systems 
is the same as the classical one, i.e., QIP = IP = PS PACE [JJUWIO] . Furthermore, quantum 
interactive proof systems still has the same expressive power if we restrict the number of mes- 
sages to three and have exponentially small one-sided error |KW00j . If the interaction is only 
one message from the prover to the verifier then the class is called QMA, which is the quantum 
analogue of NP and MA. QMA can also be made to have exponentially small error, and has 
natural complete problems |AN02j . 

Several variants of QIP and QMA have also been studied. We now focus on the case where 
some or all of the messages are small, meaning at most logarithmic in the input length. These 
cases are usually not interesting in the classical setting since a logarithmic-length message can 
be eliminated by the verifier by enumerating all possibilities. This is not true in the quantum 
case, indeed the variant of QMA where we have two unentangled logarithmic-length proofs 
contains NP |BT09j : hence not believed to be equal to BQP. On the other hand, if QMA has 
one logarithmic- length proof then it has the same expressive power as BQP [MW05j . 

Beigi et al. [BSWllj proved that in other variants of quantum interactive proof systems the 
short message can also be eliminated without changing the power of the proof system. Among 
others they showed that in the setting when the verifier sends a short message to the prover 
and the prover responds with an ordinary, polynomial-length message, the short message can 
be discarded, and hence the class has the same power as QMA. They have raised the question 
if this is also true if we replace the short question of the verifier with a 'short interaction'. I.e., 
consider quantum interactive proof systems where in the beginning the verifier and prover send 
messages to each other with the combined length of all messages being at most logarithmic, 
and at the end the prover sends a polynomial-length message to the verifier. We show that this 
class has the power of QMA, or in other words, the short interaction can be discarded. This is 
formalized by the following theorem. 
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Theorem 1.1. Let c, s : N — )■ (0, 1) be polynomial-time computable functions such that c{n) — 
s{n) G l/poly(n). Then QlPshort (log(n) , c, s) = QMA. 

Here QlPshort (log("-) > c, s) is the class described above, with completeness-soundness gap 
being separated by some inverse polynomial function of the input length. For a rigorous de- 
scription of the class see Definition 12.11 and for the notation see the discussion in Section [2l 

The remainder of the paper is organized as follows. Section [2] discusses the background 
theorems and definitions needed for the rest of the paper. The proof of the main theorem 
is split into two. Section [3] describes how to deal with the short interaction, and using that 
Section [J] finishes the proof by discussing how to handle the last round. This part closely 
follows the corresponding proof in |BSW11| . 



2 Preliminaries 

We assume familiarity with quantum information [WatOSb] . computation |NC00j and compu- 
tational complexity |Wat08aj : such as mixed states, unitary operations, quantum channels, 
representations of quantum channels, quantum de Finetti theorems, state tomography and 
complexity classes like QMA and QIP. The purpose of this section is to present the notations 
and background information (definitions, theorems) required to understand the following two 
sections. 

We denote the set of functions of n that are upper-bounded by some polynomial in n by 
poly(n). If the argument is clear, we omit it and just write poly. Similarly, we write log(n) 
or log for the set of functions that are in O(logn). We try to follow the notations used in 
[WatOSbl IBSWllj . When we talk about a quantum register (R) of size k, we mean the object 
made up of k qubits. It has associated Hilbert space n = C^'. L{TZ) denotes the space of all 
linear mappings from TZ to itself, and the set of all density operators on TZ is denoted by D{TZ). 
The adjoint of X G L(7^) is denoted by X*, and the trace norm of X by ||X||rpj.. The trace 
distance between X and Y is defined as 

^l|X-Y||,,. 

A quantum channel {^) is a completely positive and trace-preserving linear map of the form 
$ : L(Q) ^ L(7^). The set of all such channels is denoted by C(Q,7^). For any $ € C^C^^C^') 
the normalized Choi-Jamiolkowski representation of is defined to be 

x,ye{0,l}'' 

It can be generated by applying $ on one half of k pairs of qubits in the state (|00) -h |11)). 
If we are given and an arbitrary a £ D ^C^*^^^ then there exist a simple procedure which 

produces <^ (c) with probability We will refer to it as 'post-selection'. For details see 

[BSWlll Section 2.1]. 

When we talk about a polynomial-time quantum algorithm, we mean a quantum circuit 
containing Hadamard (H), vr/S (T) and controlled-not (CNOT) gates, and which can be 
generated by a classical algorithm in polynomial-time. The classes QMA and QIP have been 
defined in |AN02j and |Wat03j respectively, and we will use those definitions. Now we want 
to define the quantum interactive proof systems where in the beginning there is a log(n)-long 
interaction which is followed by a poly (n)-length message from the prover. Note that in this 
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setting we can assume, without loss of generality, that all the messages except the last one are 
one qubits, and the total number of rounds is at most O(logn). This is because we can add 
dummy qubits that are interspersed with the qubits sent by the other party. We define the class 
according to this observation. 

Definition 2.1. Let the class QlPghort ('Ti, c, s) be the set of languages for which there exist a 
quantum interactive proof system with the following properties. The completeness parameter 
is c and the soundness is s. The proof system consists of m rounds, each round is a question- 
answer pair. All questions and answers are one qubits except for the last answer which is poly(n) 
qubits, where n is the length of the input. See Figure [T] for an example with m = 3. 



prover 



/ 1 



1 / 1 



1 / 1 



poly(n) 



verifier 



Figure 1: The interaction in the proof system of Definition 12.11 in case m = 3. 



A similar class, QIP ([log, poly] , c, s) was defined in [BSWllj to be the class of problems 
for which there exist a one round quantum interactive proof system, with completeness and 
soundness parameters c and s. Additionally the verifier's question has length log(n), and the 
prover 's answer is poly(n) qubits. 

Remark 2.2. The following inclusion is trivially true between the above classes. 



QIP ([log, poly] ,c,s) C QlPshort (log (n) ,c,s) , 



for all values of c and s. 



In jBSWllj it was proven that in their setting the question from the verifier is unnecessary. 
Or more precisely: 



Theorem 2.3 ( |BSWlf| ). Let c, s : N — > (0)1) polynomial-time computable functions such 
that c(n) - s(n) € l/poly(n). Then QIP([log, poly] , c, s) = QMA. 

In the next sections we prove that the seemingly stronger class of Definition 12.11 also has the 
power of QMA if m = O(logn). For this we will need the following theorems. 



Theorem 2.4 ( jNCOOj . Chapter 4.5.2). An arbitrary unitary operator on i qubits can be im- 
plemented using a circuit containing O (£^4^) single qubit and CNOT gates. 



The next theorem follows from the Solovay-Kitaev theorem |Kit97j . and also appears in 
INCOOj . 

Theorem 2.5. For any unitary operator U on one qubit and e > 0, there exist a circuit Cu,£ 
such that Cu,e is made up o/ O (log^ (1/e)) gates from the set {H,T}, and for all \ip) S it 
holds that 

i||u|^)(^iu*-ie)(eiiiTr<^, 

where \C) =^ Cu,e(|<^)). 
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The following is corollary to Theorem 12.41 and 12.51 

Corollary 2.6. For any unitary operator \J on £ qubits and £ > 0, there exist a circuit Cu,e 
such that Cu,e is made up ofO{^5^ • log'^ (5^/e)) gates from the set {H, T,CNOT}, and for all 
\tp) € C^* it holds that 

^||U|^)MU*-|e)(e||lTr<^, 

where \C) =^ Cu,e(i<^)). 

Lemma 2.7 (Lemma 1 of [BSWllj ). Let p G D(C^'') be a state on q = O(logn) qubits. For 
any e G l/poly(n), choose N such that N > and N G poly(n). If p®^ is given to 

a po\y (n) -time quantum machine, then it can perform quantum state tomography, and get a 
classical description ^ G L(C^'') of p, which with probability at least 1 — e satisfies 

Wp-CWtv < 



Theorem 2.8 (quantum de Finetti theorem jCKMROT] : this form is from |Wat08bj ). Let 

Xi , . . . , X„ be identical quantum registers, each having associated space C^, and let peD (C^") 
be the state of these registers. Suppose that for all permutation ir £ Sn it holds that p = 
W^pW*, where permutes the contents o/Xi, . . . ,X„ according to vr. Then for any choice 
of k £ {2, 3, . . . , n — 1} there exists a number N £ N, a probability vector p G M^, and a 
collection of density operators {ai : i G {1, 2, . . . , N}} C D (C'^) such that 

N 
i=l 



< 



Ad^k 



Tr 



n 



3 Compressing the prover's private space 

This section proves that during the initial short interaction the prover doesn't need to keep too 
many qubits in its private memory. This will make it easy to give the description of the actions 
of the prover during these rounds as a classical proof. This idea of upper-bounding the prover's 
private space has also appeared in |KM03] . 

From now on, let L G QlPghort ("T- + IjC, s), let V be the verifier and P be the (honest or 
dishonest) prover. We now describe what happens in each but the last round, so we can give a 
name to all quantum registers in the process. 

In the beginning of round i for i G {1, 2, . . . , m} the prover is holding some private register 
from the previous round which we call Pj_i. The verifier is holding the answer from the previous 
round (Ai_i) and his private register (Vj_i). Note that Aj_i is made up of one qubit and Vj_i 
is poly(?7.) qubits. The verifier applies a unitary transformation Wj on Aj_iV.j„i, and gets the 
registers Qj and V, as the output. The one qubit Q, holds the ith question, while the poly-qubit 
Vj is the verifier's new private register. The verifier then sends Qj to the prover, who applies 
the unitary Uj on Pj_iQj and gets Pj and Aj as the output. At the end of the round the prover 
sends back Aj to the verifier. Figure [2] shows a schematic of this procedure. Note that it is 
without loss of generality that for all G {1,2,... ,m}, Pj has the same number of quibts 
as Pj, and the same is true for all VjS. Moreover all QjS and AjS are one qubits. Since we 
introduce new registers whenever an operation takes place, we can talk about 'the state of a 
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register' without confusion. Without loss of generality we set the sate of PqAqVo to be |00 ... 0). 
We didn't put any upper bound on the size of register Pj. However, the prover doesn't need 
arbitrary big private space, neither in the honest nor in the dishonest case. This is formalized 
by the following lemma. 

















P^ 












J 




A* 






Ai-1 




















y — ^ 














J 







V,; 



Figure 2: Schematic of round z in a QlPshort proof system. 



Lemma 3.1. Fix any verifier strategy V and prover strategy P for an input to the problem L, 
as described above. Then we can construct another prover P' which makes the verifier accept 
with exactly the same probability as P, and if V interacts with P' then for all i € {1, 2, . . . , m\, 
at most 2i qubits of Pj will have state different than |0). 

Proof. We prove the lemma by induction on i. I.e., we modify P round-by-round to satisfy the 
statement of the lemma. If i = then Pq already has all qubits in state |0), so we are done. 

Now suppose that for some i, we have that at most 2i qubits of Pj has state different than |0). 
Then we will show that at most 2i -|- 2 qubits of Pj+i has state different than |0), by modifying 
P, such that the acceptance probability will stay the same. So let us consider the situation in 
round (i -|- 1), right after the verifier sent Qi+i to the prover. See Figure El Let's denote the 
part of Pi that contains something other then |0) by P^. By the induction hypothesis, the size of 
P^ is < 2i. Since the joint state of P^Qj+iVj_|_i is pure, there exist a unitary Xj+i acting on Vj+i 
and transforming it to Wj+i of size < 2i -|- 1 and a register containing only |00 . . . 0) . Suppose V 
performs this operation and let us not worry now about whether it is doable in polynomial time. 
Now P' performs Uj+i and gets Pj+i and A^+i. Now the joint state of Pj+iAj+iWj+i is pure, 
so by the same argument as before, we have that there exist a unitary Yj+i that transforms 
Pj+i into P'i^i of size <2i + 2 and some register containing only |00 . . . 0) . Our P' performs this 
Yj+i as well. Now V performs and gets back Vj+i. Additionally P' in the next round will 
perform Y^^^^^ just before it is about to perform \JiJf-2, so at that point the state of the whole 
system will be the same as in the original proof system, so the acceptance probability won't 
change. Note that V doesn't actually need to perform Xj+i since it is followed by X^;^^^. So we 
don't need to modify V at all. This finishes the proof of the lemma. □ 

Corollary 3.2. Without loss of generality, for all i G {1,2,... ,m} we can assume that Pj is 
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Figure 3: Modification of the prover in round i + l, in the proof of Lemma l3. II 



made up of at most 2m qubits, both in the honest and dishonest case. Furthermore, the action 
of the prover in round i is still a unitary, transforming Pj-iQj to PjAj. 

4 Proof of the main theorem 

This section finishes the proof of the main theorem by using the result from the previous section. 
The idea is that the prover's unitaries in the first m rounds can be given as classical descriptions 
of quantum circuits. Using this, the QMA verifier can approximately produce the state of the 
whole system appearing before the last round in the QIP protocol. This means the prover's 
private space, the answer to the verifier and the verifier's private space. To simulate the last 
round, we don't need to care about the prover's private space, so we treat its operation as 
a quantum channel, acting on the the private space of the prover and the question from the 
verifier. Since the input is on log-many qubits, to perform the action of this channel, we can 
use the same method as in |BSW11| Section 3]. The detailed proof is as follows. 

Proof of Theorem \l.l\ The inclusion QMA C QlPghort (log("') ) c, s) is trivial, so we only need 
to prove QlPshort (log('^) ) c, s) C QMA. Just as above, let L G QlPghort ("i + li c, s), where 
m = O(logn), and let V be the corresponding verifier. We will construct a verifier W for the 
QMA proof system. Because of Corollarv \'6.2\ we can assume that any prover strategy in the 
first m rounds are unitary operators on 2m qubits, say Ui, . . . , U^- The constructed W expects 
to get as part of the proof, the classical descriptions of circuits Cuj^i/sn, . . . , Cu^^i/3»i, i.e., the 
circuits that approximate the prover's operators with precision 1/3". According to Corollarv l2.6l 
the length of this proof is 0{m ■ 5^"* • log^ (5^™ • 3")) € poly(n). W uses this classical proof to 
simulate the first m rounds of the proof system, and produce the state of registers Pm^rn^m, 
which we denote by Note that since each circuit approximates the corresponding unitary 
with precision 1/3", after applying log-many of them, it is true that 

1 TD 1 

-|||^)(^|-|<^)(0|||t,<-<-, 

for sufficiently large n; where {(p) is the state of Pm^rrym in the case where the unitaries 
Ui, . . . , JJm were applied instead of the circuits. 
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We are left with specifying how W simulates the prover in the last (m + l)th round. We use 
exactly the same method as in the proof of Theorem 12.31 appeared in [BSWllj , and our proof 
closely follows that proof as well. Since we are in the last round, we don't have to keep track 
of the prover's private space, so we can just describe it's strategy as a quantum channel that 
transforms registers PmQm+i to A^+i- Let's call this channel <I> G C{S,TZ) from now on; where 
S is the joint space associated to registers PmQm+i, and TZ is the space associated to Am+i- 
The input space 5 is on g =^ 2m + 1 = O(logn) qubits and the output space TZ is on poly(n) 
qubits. W expects to get p^^^"'''^^ as the quantum part of it's proof, where /9$ G D(7^(8)5) is 
the normalized Choi-Jamiolkowski representation of for N and k to be specified later. Let's 
divide up the quantum certificate given to W into registers Ri, Si, R2, S2, RAf+fci ^N+k, 
where the space of each Rj is TZ, and the space of each Sj is S. W expects each RjSj to contain 
a copy of To simulate the last round of the interactive proof system, W does the following. 

1. Randomly permute the pairs (Ri, Si) , . . . , (Rat+a;, SAr+fc), according to a uniformly chosen 
permutation, and discard all but the first {N + 1) pairs. 

2. Perform quantum state tomography on the registers (S2, • • • , Sjv+i), and reject if the 
resulting approximation is not within trace-distance S/2 of the completely mixed state 
(1/2'?) 1, for S to be specified below. 

3. Simulate the channel specified by (Ri,Si) by post-selection. Reject if post-selection fails, 
otherwise simulate the last operation of V and accept if and only if V accepts. 

Let g{n) € poly(?i) be such that c(n) — s{n) > l/g{n). We now set the parameters. 



dof 1 ^ def e dcf 

^ = .11 , = — , N = 



2l0q 



■49+1 (iv + 1) 



Note that 1/5, iV, /c G poly(n) 



Completeness. Suppose there exist a P that causes V to accept with probability > c. Let 
the certificate to W be the classical descriptions of circuits Cu^^i/an, Cu,,^ 1/371, together 

with the state p%^^^^\ where each RjSj contains a copy of p$, for z G {1, 2, . . . , + k}. After 
simulating the first m rounds, W produces IV') which is < 1/2" far from the correct in the 
trace distance, just as described above. Note that in the simulation of the last round, step [1] 
doesn't change the state of registers (Ri, Si) , . . . , (Rat+i, Sat+i). According to Lemma [27FI W 
rejects in step [2] with probability < 6/2. In step [3l post-selection succeeds with probability 
1/4'?. liW was using \(j)) instead of \tjj) the probability of acceptance would be at least 

2y 4'? 

So using 1-0), the probability that W accepts is at least 

5\ c I c 1 

1-- > e . 

2^4? 2" ~ 4'? 2" 

Soundness. Suppose that all P causes V to accept with probability < s. Note that, without 
loss of generality any classical proof specifies some set of unitaries that correspond to a valid 
prover strategy. Hence it is still true, that after W simulates the first m rounds using the given 
circuits, it ends up with a state that is at most 1/2*^ far from a state |(/)), where \(f)) can be 
produced by some P interacting with V . 
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Now consider the situation that the state of (Si, . . . , Sat+i) before step [3] has the form 

f7®(^+l), (1) 

for some a G 0(5). (The classical part of the proof has been used up and discarded before 
stepdJ) We consider two cases: 

• Suppose that \a — (1/2"^) l||rpj. < b. Let the state of (Ri, Si) before step[3]be ^ S D(7?, ® S), 
so we have Tr7^(^) = a. Because of the same argument as in |BSWllj . there exists a state 
r G D(7^ (g) 5) such that TrniT) = (1/2'^) 1 and i ||r - CHxr < ^- Given this r, the post- 
selection in step El succeeds with probability 1/4'' , so the acceptance in step [3] occurs with 
probability at most 5/4"? + 1/2"'. Given ^ instead of r, W will accept with probability at 
most 

s 1 
\ he. 

• If ||c7 — (1/2'^) l||rp^ > (5, then in stepEl W will accept with probability < 6/2. 

Since 5/2 < s/4^ + 1/2" + e then in both cases acceptance occurs with probability < s/4'' + 
1/2" +e. 

Now suppose that the state of (Si, . . . ,SAr+i) before step [3] has the form 

i 

for some probability vector p and some set {cjj} C D(5). Since ([2|) is a convex combination of 
states of the form ([TJ, acceptance will occur with probability < s/4'' + 1/2" + e. In the real 
scenario, by Theorem 12.81 it is true that the state of (Si, . . . , Sat 4.1) after step [T] will be e close 
to a state of the form ([2]), in the trace distance. So the probability of acceptance of W will be 
< s/4'' + 2e + 1/2". Since 

c 1 / s 1 , 

+ 2e + —]> 



41 2" \ii 2"y - /i(n)' 

for some h{n) G poly(n), it holds that L G QMA. □ 
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